Tootfinder

A follow up here on action items (assuming you’re already using trusted publishers OIDC to scope releases to a single GitHub Action workflow):
1. Look for any `pull_request_target` GitHub Actions workflows! (this allows external forks/code to run your actions with write access ☠️☠️☠️☠️☠️)
2. Look for use of `cache` in your GitHub Actions release workflow (cache was poisoned/compromised by `pull_request_target` trigger)
Learn more about `pull_request_target`:

Former Trump and Biden AI advisers Dean Ball and Ben Buchanan urge bipartisan action on AI security risks, including tighter export controls and safety audits (New York Times)
https://www.nytimes.com/2026/05/04/opinion

Opinion | A.I. Is a National Security Risk. We Aren’t Doing Nearly Enough.
Both parties can agree to do a whole lot on A.I., but they have to move faster.

Republicans block war powers resolution again
after Democrats grill Hegseth on Trump’s ‘unauthorized war’ in Iran
Republican senators blocked a sixth attempt to limit US military action in Iran
Democrats criticize Trump’s defense secretary and "strategy" in the Middle East

The font and colors are subject to change, (though I'm kind of digging the dark blue), but the next portion of the Warlock project is coming together! This will serve as the public documentation and information site for the project, for folks not wanting to solely use Github. Still a lot of work to do, but making good progress on it.
OH, and the screenshot is being generated by the following "code"

::: section .showcase
::: .blocks-2
::: .block

# Warlock Ne…

Filings: President Trump purchased up to $5M each in Broadcom, Meta, Amazon, Apple, Microsoft, and Nvidia stocks on July 23, the same day as his AI action plan (New York Times)
https://www.nytimes.com/2026/07/01/us/pol…

Crypto Brought Trump a Huge Windfall, Even as Many Investors Lost Big
President Trump and his family reaped vast financial rewards from a memecoin that generated losses for hundreds of thousands of investors.

After a security researcher published a series of unpatched bugs in Microsoft products, along with code to exploit them,
the company is now threatening to take legal action and call the cops on them.
Microsoft’s threat reignites a long-running argument over what responsibility, if any, security researchers have to disclose vulnerabilities affecting large and wealthy tech giants.
On Wednesday, Microsoft published a blog post criticizing the researcher, who goes by the handl…

Microsoft under fire for threatening security researcher with criminal investigation | TechCrunch
A public spat between Microsoft and an independent security researcher reopens a long-running debate over who is responsible for securing software.